Third-Party Risk Management Metrics That Prove Your Program Works
Someone on your leadership team is going to ask what the TPRM program actually did last year. If the honest answer is "nothing bad happened," that could mean the program is working, or it could mean nobody would notice if it wasn't. Right now, you have no way to prove which one is true.
Two metrics fix that, and neither one needs an incident first. Almost no team produces either one.
Count Every Supplier, Then Report a Fraction
If your last report to leadership included a line like "we assessed 340 suppliers," it told them almost nothing. Three hundred and forty could be strong coverage or a rounding error, and the sentence gives no way to tell which.
Pull your supplier master. Count every supplier you actually transacted with in the trailing twelve months. That is your denominator. Report your assessed count as a fraction of it: 340 of 1,200, not 340.
Then do it again for your critical tier alone: the suppliers with banking access, system access, or regulatory exposure. Report that fraction separately from the total. A strong number for the whole base can sit on top of a weak number for exactly the suppliers where a gap costs the most, and reporting one fraction for everyone hides the second one.
Start Logging Every Intervention
Coverage tells you how much ground the program watches. It does not tell you whether the program does anything when it finds a problem. That takes a second number, produced by instrumenting the process to record what it actually stops.
Every time your process catches something that would otherwise have gone through, log it: a supplier that never made it past screening, and a bank-detail change flagged and verified before the payment went out.
Total the log every quarter and break it out by type. "The process caught six altered bank details this quarter and stopped payment on each one" is a specific, checkable claim about a control doing its job.
One rule matters more than the total. If a later step in your process would have caught the same thing anyway, the earlier step never really stopped it, and logging it as a catch costs more credibility than the number is worth. When it is close, count against yourself. A cautious number that survives scrutiny beats an impressive one that does not.
